Integrated Windows authentication is most frequently used within intranet
environments since it requires that the server performing the authentication and
the user being authenticated are part of the same domain. For the user to be
authenticated automatically, the client machine used by the user must also be
part of the domain.

There are several options for implementing integrated Windows authentication
with Apache Tomcat. They are:

Built-in Tomcat support.

Use a third party library such as Waffle.

Use a reverse proxy that supports Windows authentication to perform the
authentication step such as IIS or httpd.

The configuration of each of these options is discussed in the following
sections.

This is a work in progress. There are a number of outstanding
questions that require further testing. These include:

Does the domain name have to be in upper case?

Does the SPN have to start with HTTP/...?

Can a port number be appended to the end of the host in the SPN?

Can the domain be left off the user in the ktpass command?

What are the limitations on the account that Tomcat can run as? SPN
associated account works, domain admin works, local admin doesn't
work

There are four components to the configuration of the built-in Tomcat
support for Windows authentication. The domain controller, the server hosting
Tomcat, the web application wishing to use Windows authentication and the client
machine. The following sections describe the configuration required for each
component.

The names of the three machines used in the configuration examples below are
win-dc01.dev.local (the domain controller), win-tc01.dev.local (the Tomcat
instance) and win-pc01.dev.local (client). All are members of the DEV.LOCAL
domain.

Note: In order to use the passwords in the steps below, the domain password
policy had to be relaxed. This is not recommended for production environments.

These steps assume that the server has already been configured to act as a
domain controller. Configuration of a Windows server as a domain controller is
outside the scope of this how-to. The steps to configure the domain controller
to enable Tomcat to support Windows authentication are as follows:

Create a domain user that will be mapped to the service name used by the
Tomcat server. In this how-to, this user is called tc01 and has a
password of tc01pass.

Map the service principal name (SPN) to the user account. SPNs take the
form
<service class>/<host>:<port>/<service name>.
The SPN used in this how-to is HTTP/win-tc01.dev.local. To
map the user to the SPN, run the following:

setspn -A HTTP/win-tc01.dev.local tc01

Generate the keytab file that the Tomcat server will use to authenticate
itself to the domain controller. This file contains the Tomcat private key for
the service provider account and should be protected accordingly. To generate
the file, run the following command (all on a single line):

These steps assume that Tomcat and a Java 6 JDK/JRE have already been
installed and configured and that Tomcat is running as the tc01@DEV.LOCAL
user. The steps to configure the Tomcat instance for Windows authentication
are as follows:

Copy the tomcat.keytab file created on the domain controller
to $CATALINA_BASE/conf/tomcat.keytab.

Create the kerberos configuration file
$CATALINA_BASE/conf/krb5.ini. The file used in this how-to
contained:

The location of this file can be changed by setting the
java.security.auth.login.config system property. The LoginModule
used is a JVM specific one so ensure that the LoginModule specified matches
the JVM being used. The name of the login configuration must match the
value used by the authentication
valve.

The system property javax.security.auth.useSubjectCredsOnly
is automatically set to the required value of false if a web application is
configured to use the SPNEGO authentication method.

The SPNEGO authenticator will work with any
Realm but if used with the JNDI Realm, by default the JNDI Realm will use
the user's delegated credentials to connect to the Active Directory.

The above steps have been tested on a Tomcat server running Windows Server
2008 R2 64-bit Standard with an Oracle 1.6.0_24 64-bit JDK.

The web application needs to be configured to the use Tomcat specific
authentication method of SPNEGO (rather than BASIC etc.) in
web.xml. As with the other authenticators, behaviour can be customised by
explicitly configuring the
authentication valve and setting attributes on the Valve.

The client must be configured to use Kerberos authentication. For Internet
Explorer this means making sure that the Tomcat instance is in the "Local
intranet" security domain and that it is configured (Tools > Internet
Options > Advanced) with integrated Windows authentication enabled. Note that
this will not work if you use the same machine for the client
and the Tomcat instance as Internet Explorer will use the unsupported NTLM
protocol.